Legal
Privacy Notice
Bulkdata.ai (“we”, “us”, “our”) operates a business-to-business contact and company database. This notice explains what personal data we hold, why we hold it, and what you can do about it. If you have questions, contact us at support@bulkdata.ai.
Contents
Controller for personal data
A controller is a person or organisation who, alone or jointly, determines the purposes for which and the way any personal data is processed. We are the controller of the personal data described in this notice unless we tell you otherwise.
Scope
This notice applies to our processing of personal data in connection with:
- Customers who sign up to our services.
- Visitors and prospective customers who contact us through our website.
- Database Contacts — working professionals whose business information appears in the database we make available to our customers. This is the section that applies to you if you have never dealt with us directly. See section 4.
You do not need to read this whole notice. Email support@bulkdata.ai with the subject “Remove my details”. There is no charge and you do not need to give a reason. We will confirm once it is done.
How we collect your personal data
Directly from you. When you create an account or sign in, we collect your name, company name and email address. That is the only personal information we ask you for. If you contact us, we also have the content of your message.
Created as you use the service. Using the service generates records about your account: sign-in attempts and their outcome, which contact records you have unlocked, the credits that movement used, and any watchlists you save. These are described in section 5.
Database Contacts
Our database contains professional information about working individuals at the organisations our customers are interested in. If you have never dealt with us, this is the section that applies to you. We did not obtain this information from you, and we are required to tell you the following.
Where this information comes from
We obtain it from two kinds of source:
- Publicly available sources on the internet — professional networking profiles, company websites, published team pages and similar openly accessible material.
- Third-party datasets that we purchase from organisations that compile business contact information. The email addresses and telephone numbers in our database come from these datasets. We do not generate or infer them, and we do not construct email addresses from a company’s address pattern.
What the database contains
Not every field is held for every person. A record may contain any of the following:
- Identity — name, and a link to a public professional profile.
- Professional — job title, seniority, job function, profile headline, employer, and time in role.
- Work location — city, region and country.
- Background — education history, professional certifications, skills and languages, where publicly stated.
- Contact — work email address and telephone number.
Information we derive
We also generate our own classifications from the information above. We tell you this plainly because it forms part of the personal data we hold about you, and you have the same rights over it:
- Seniority and function — we map a job title to a standard seniority level and business function so roles can be compared across employers.
- Record completeness and stability — indicators of how much information a record holds and whether it is gaining or losing detail over time.
We do not use these classifications to make automated decisions that produce legal effects or similarly significant effects on you. We do not form opinions about you as an individual beyond describing your professional role.
Why we hold it
| Processing activity | Categories of personal data | Lawful basis |
|---|---|---|
| Compiling and maintaining the database, and making it available to our customers so they can identify and contact the right people at other organisations for professional purposes | Name, business contact details, role and employer, professional background, and the classifications we derive | Necessary for our legitimate interests and those of our customers, in enabling business-to-business communication — Article 6(1)(f) UK GDPR / EU GDPR |
| Verifying and re-verifying records so the information we hold is accurate and current | Name, business contact details, role and employer | Necessary for our legitimate interests in data accuracy — Article 6(1)(f) |
| Maintaining a suppression list so that individuals who have opted out are not reintroduced | The minimum needed to recognise and exclude you | Necessary for our legitimate interests, and to honour objections we have received — Article 6(1)(f) |
In relying on legitimate interests, we have weighed our interests against yours. The data is limited to your professional identity rather than your private life; business contact information is ordinarily shared in a professional context, and its use for professional approaches is within reasonable expectations; the impact on you is low and is further reduced by the safeguards below; and you may object at any time, at which point we stop.
Safeguards
- Contact details are hidden by default and released only when a customer deliberately requests a specific record.
- Every release is logged against the customer account that requested it.
- The number of records returned by a single search, and the number that can be unlocked at once, are capped.
- Access requires an authenticated account in good standing.
Customer processing
| Processing activity | Categories of personal data | Lawful basis |
|---|---|---|
| Creating your account, authenticating you, and providing the service | Your name, company name and email address | Performance of a contract — Article 6(1)(b) |
| Metering credits, recording which records you unlock, and making sure you are not charged twice for the same record | Your account, and a record of which contact records you unlock | Performance of a contract — Article 6(1)(b) |
| Storing and re-running the watchlists you create | Your account, and the watchlists you save | Performance of a contract — Article 6(1)(b) |
| Security monitoring, detecting brute-force attempts and abuse, and lock-out | Your email address, and the IP address and browser recorded at sign-in | Necessary for our legitimate interests in protecting our service and our customers — Article 6(1)(f) |
| Responding to your enquiries and providing support | Your email address and the content of your message | Performance of a contract — Article 6(1)(b); and legitimate interests in responding to you — Article 6(1)(f) |
Visitors and prospective customers
| Processing activity | Categories of personal data | Lawful basis |
|---|---|---|
| Responding when you contact us through our website or by email | Your contact details and the content of your message | Necessary for our legitimate interests in being able to respond to you — Article 6(1)(f) |
AI assistants and connectors
Our service can be connected to AI assistants such as Claude, ChatGPT, Gemini and Grok through the Model Context Protocol.
- Sign-in happens on our own pages. The AI assistant never receives your password — only a scoped access token, which you can revoke by removing the connector.
- When you use a connector, your queries and the results we return pass through that assistant’s provider and are subject to their privacy notice in addition to ours. Please check the terms of whichever assistant you use.
- We record the fact and time of a request and the account that made it, so credits are metered correctly and to guard against abuse.
- We do not use your queries, or the personal data in our database, to train artificial intelligence models.
Disclosure of personal data
We do not share personal data with advertising networks or other data brokers for advertising purposes.
Data security
We protect personal information through organisational and technical measures, including encryption in transit, one-way hashing of passwords, restricted access to production systems, logging of authentication events and data access, and lock-out after repeated failed sign-in attempts.
No electronic transmission or storage technology can be guaranteed completely secure, so we cannot promise that unauthorised third parties will never defeat our measures.
Carrying out your rights
You will not have to pay a fee to access your personal data or to exercise any of your other rights. We may charge a reasonable fee, or decline to act, if a request is clearly unfounded, repetitive or excessive.
We may need specific information from you to confirm your identity — a security measure to ensure personal data is not disclosed to anyone who has no right to receive it.
We will acknowledge your request and keep you updated on its progress.
Concerns and complaints
We would appreciate the chance to deal with your concerns in the first instance — please contact us.
California privacy notice
This section applies to California residents, including people who appear in our database as business contacts, and supplements the rest of this notice. It is given under the California Consumer Privacy Act as amended (the “CCPA”).
What we collect, and where it comes from
| CCPA category | Examples | Sources |
|---|---|---|
| Identifiers | Name, work email address, work telephone number, city, region and country | Publicly available internet sources; purchased third-party datasets |
| Professional or employment information | Job title, seniority, job function, employer, time in role | Publicly available internet sources; purchased third-party datasets |
| Education information | Publicly stated education history, certifications, skills and languages | Publicly available internet sources |
| Inferences | Seniority and job-function classification, and record completeness and stability indicators | Derived by us from the categories above |
| Internet or network activity | Sign-in records, use of the service | Generated as customers use the service |
We use this information for the purposes set out in section 4 and section 5. We do not collect or use sensitive personal information as the CCPA defines it, so the right to limit its use does not apply.
Sale of personal information
Making Database Contact records available to our customers is a “sale” of personal information under the CCPA, and we tell you so plainly rather than relying on a narrower reading. We do not “share” personal information for cross-context behavioural advertising, and we do not sell personal information to advertising networks. We do not knowingly sell the personal information of anyone under 16.
Your California rights
- Know — the categories and specific pieces of personal information we hold about you, where we got them, why we hold them, and who we disclose or sell them to.
- Delete — ask us to delete the personal information we hold about you.
- Correct — ask us to correct personal information that is inaccurate.
- Opt out of sale — direct us to stop selling your personal information.
- Non-discrimination — we will not treat you worse, or charge you differently, for using any of these rights.
How to make a request
Email support@bulkdata.ai with the subject “Do Not Sell My Personal Information”. We action opt-out requests within 15 business days, and we add you to our suppression list so you are not reintroduced.
For requests to know, delete or correct, email support@bulkdata.ai. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need longer we may extend that by a further 45 days and will tell you why. We may ask you to verify your identity by matching the information you give us against what we already hold. You may use an authorised agent, who must provide your signed written permission.
Requests are free, and you do not need to give a reason. If you are a Database Contact and simply want to be removed altogether, the route in section 2 does that for you wherever you live.